A security policy forbids direct SSH/RDP to EC2 instances; authorized staff use AWS Systems Manager Session Manager instead. Users cannot connect to one Ubuntu EC2 instance that has the SSM Agent preinstalled, but they can use Session Manager to access other instances in the same subnet. The users belong to an IAM group that has Session Manager permissions for all instances. What action should a SysOps administrator take to fix the problem?

The correct action is to attach the AmazonSSMManagedInstanceCore managed policy to the IAM instance profile. For an EC2 instance to be managed by AWS Systems Manager, it requires an IAM role with specific permissions, typically granted by this policy, which allows the SSM Agent to communicate with the Systems Manager service. Without these permissions, the SSM Agent cannot register the instance or establish a session, even if it's installed and running. Opening port 22 is incorrect because the security policy forbids direct SSH/RDP, and Session Manager does not use SSH ports for its primary connection. Configuring the SSM Agent to use a specific username is unnecessary and doesn't address the underlying connectivity issue. Generating a new SSH key pair is also incorrect as Session Manager does not rely on SSH keys for its core functionality and the policy specifically prohibits direct SSH.